Executive brief
Nodemailer is a popular Node.js library for sending emails. A flaw in its email address parser allows an attacker to craft malicious recipient addresses that bypass domain validation checks and cause emails to be delivered to attacker-controlled domains. Organizations relying on Nodemailer to enforce domain allowlists or other recipient validation rules could have their emails misdirected.
Technical details
The vulnerability is an Interpretation Conflict (CWE-436) in Nodemailer's RFC 5322 email-address parser. The parser incorrectly treats RFC 5322 comments (parenthesized text like "(x)") as a concatenation point for surrounding domain atoms, rather than as folding whitespace that terminates the domain. An attacker can craft a recipient address such as "user@good-corp.com(x)evil.com" which a compliant RFC 5322 parser (or allowlist checker) sees as "good-corp.com", but Nodemailer parses and routes to "good-corp.comevil.com" (a registrable attacker-controlled domain). The root cause lies in lib/addressparser/index.js where the tokenizer's "noBreak" flag causes concatenation of tokens across comment boundaries. Exploitation requires a mismatch between the application's domain validation logic and Nodemailer's parsing. The flaw has been verified end-to-end against live SMTP servers. A patch is available in version 9.1.0.
Affected products
- Nodemailer Nodemailer 6.9.16 to 9.0.6
Timeline
- 2026-09-08: disclosed
- 2026-09-01: patched: patched in version 9.1.0